Remote Information Security Engineer - Path to CISO

Embedded Shishya; United States; Remote; USD 140,000 - 230,000; Full time

Benefits offered by this job

Ownership of security program

CISO growth path

Fully remote with flexible hours

Direct access to leadership and bank-s

Job summary

Embedded Shishya seeks its first dedicated information security hire to own and mature security across the stack. The role is fully remote with a hands-on focus on AWS, IaC, detection, and response, growing toward CISO as the company scales.

You will work with auditors, manage SOC 2 controls, and handle GDPR/CCPA, DORA, EBA guidelines for EU customers, while enabling secure collaboration with major financial institutions.

Qualifications

• 5+ years in security engineering or security-heavy infrastructure work, with depth in AWS security (IAM, SCPs, logging, detection, encryption).
• Python and Terraform, or close equivalents. You automate evidence collection instead of maintaining spreadsheets.
• SOC 2 experience, ideally owning a Type II audit. Working knowledge of privacy legislation.
• Exposure to financial-services customer scrutiny, or the appetite to make it your specialty.
• A working view on LLM security risks, or strong fundamentals and the curiosity to build one.
• Judgment about which risks matter; you can explain controls to auditors and engineers alike.
• Clear writing; remote work requires async, with policies and risk memos speaking for you.
• Ambition to grow into an executive role and the people skills to survive it.

Responsibilities

• Own security in our AWS environment: IAM and least privilege, network segmentation, encryption, logging and detection (GuardDuty, Security Hub, CloudTrail).
• Build security into the development pipeline: secrets management, dependency scanning, code review for risky changes, threat modeling with engineers.
• Automate detection, evidence, and IaC guardrails; codify controls where possible.
• Run vulnerability management and incident response; write runbooks and conduct drills.
• Define data handling for AI/LLM use: vendor data flows, model approvals, prompts and outputs logging.
• Manage SOC 2: control design, automated evidence collection, auditor relationships.
• Handle regulatory aspects for financial customers: GDPR, CCPA, DORA, EBA, GLBA, SEC/FINRA in US, etc.
• Lead customer security reviews and vendor risk assessments; contribute to security terms in contracts.
• Develop security awareness training to improve phishing resilience and identity hygiene.
• Set security strategy over time: report risk, select tooling, build budget, hire.

Skills

Security engineering

Python

Terraform

SOC 2

LLM security

Auditing

Risk assessment

Technical writing

Tools

AWS

GuardDuty

Security Hub

CloudTrail

Job description

Embedded Shishya seeks its first dedicated information security hire to own and mature security across the stack. The role is fully remote with a hands-on focus on AWS, IaC, detection, and response, growing toward CISO as the company scales.

You will work with auditors, manage SOC 2 controls, and handle GDPR/CCPA, DORA, EBA guidelines for EU customers, while enabling secure collaboration with major financial institutions.